Network security management is becoming a more difficult problem as networks grow in size and become a more integral part of organizational operations. Attacks on networks are growing both due to the intellectual challenge such attacks represent for hackers and due to the increasing payoff for the serious attacker. Furthermore, the attacks are growing beyond the current capability of security management tools to identify and quickly respond to those attacks. As various attack methods are tried and ultimately repulsed, the attackers will attempt new approaches with more subtle attack features. Thus, maintaining network security is on-going, ever changing and an increasingly complex problem.
One example of a network attack on a network device, e.g., server, may commonly be referred to as a denial-of-service attack. In a denial-of-service attack, the network device is flooded with so many additional requests that regular traffic is either slowed or completely interrupted. Typically, the denial-of-service attack uses multiple computers throughout the network. A denial-of-service attack that uses multiple computers may commonly be referred to as a distributed denial-of-service attack.
Such attacks may involve the dissemination through the network, such as the Internet, of a malicious program, e.g., virus, worm program. The malicious program typically contains both the code for sourcing a variety of attacks, e.g., distributed denial-of-service attack, and some basic communication infrastructure to allow for remote control. For example, a user commonly referred to as an attacker may disseminate a malicious program by transmitting the malicious program over the Internet with random Internet Protocol (IP) destination addresses. If one of the random destination addresses is an address of a “vulnerable” computer system, e.g., server, then the malicious program may be installed on that computer system. A computer system may be said to be “vulnerable” if the computer system cannot detect and hence prevent the malicious program from being installed. Hence, an attacker may be able to install malicious programs on other computer systems thereby producing a group of “zombie” computers to carry out the attack.
Computer systems may store security management tools configured to detect known patterns of known malicious programs. For example, security management tools may examine each received IP packet and determine if it matches a known pattern. If so, then the dissemination of a malicious program may be detected. However, if the security management tools do not detect a known pattern, then the security management tools may determine that a malicious program is not being disseminated on the computer system. Hence, a newly created malicious program whose pattern is unknown may not be detected by the security management tools.
As stated above, the dissemination of malicious programs by an attacker typically involves the attacker transmitting the malicious program over the network, e.g., Internet, with random IP destination addresses. By detecting the randomness in IP destination addresses, the dissemination of newly created malicious programs may be detected.
It would therefore be desirable to detect the randomness in Internet Protocol (IP) destination addresses in order to detect the dissemination of malicious programs.